Bpost Shipping Platform
Monthly
SQL injection in the bpost Shipping Platform WordPress plugin (versions before 3.2.3) lets unauthenticated attackers inject SQL via an unsanitized parameter processed during WooCommerce order submission, enabling time-based blind extraction of database contents. Any WooCommerce store using this Belgian-postal shipping integration is exposed at checkout without authentication or user interaction. Publicly available exploit code exists (WPScan) and a vendor patch is available, though there is no public exploit identified as being actively used in the wild (not in CISA KEV).
SQL injection in the bpost Shipping Platform WordPress plugin (versions before 3.2.3) lets unauthenticated attackers inject SQL via an unsanitized parameter processed during WooCommerce order submission, enabling time-based blind extraction of database contents. Any WooCommerce store using this Belgian-postal shipping integration is exposed at checkout without authentication or user interaction. Publicly available exploit code exists (WPScan) and a vendor patch is available, though there is no public exploit identified as being actively used in the wild (not in CISA KEV).